Xingqi App Privacy Notice

01Scope and how to contact us

The entity responsible for processing personal information is 星线软件技术（四川）有限责任公司 (referred to as “Starline” or “we”). This notice covers the iOS version of the Xingqi App, its Android development preview, and the enterprise collaboration services they actually provide. Platform differences are explained separately below. The App identifier is cn.thestarline.xingqi, and the existing filing number is 蜀ICP备2026057076号-3A. These identifiers do not mean that the Android version has been officially released in an app store or that enterprise collaboration services are available to the public. The Starline App and other independent products have their own notices.

This notice takes effect on October 19, 2026. The Android version of Xingqi is currently available only as a development preview, which may use a local sample account and demonstration services. Production account sign-in, enterprise collaboration services available to the public, and app-store release have not completed acceptance checks. Do not submit sensitive information belonging to a real enterprise in the development preview. Available features depend on the actual entry points in the version you receive and the services that have opened. Processing for a feature occurs only when you actually use it. We will explain the processing rules for unavailable features before opening them. New features and processing activities will be notified and any necessary authorization obtained in accordance with law.

Privacy inquiries, personal information rights requests, and account deletion requests can be submitted for manual handling through the WeCom channel shown on this privacy website’s Contact Starline page. First explain the matter and provide information that identifies the relevant account. Confirm the recipient before submitting necessary materials as instructed. Do not send passwords, verification codes, or identity documents unrelated to your request.

02Processing purposes and information inventory

Xingqi supports contact between members of the same organization, text communication, tasks, announcements, and access to workplace services. We process information as needed to provide the services you choose, verify permissions, maintain security, handle requests, and fulfill legal obligations. Organization collaboration requires signing in and having access to the relevant organization or conversation. Without the necessary account information or collaboration content, the corresponding feature cannot be used.

The main information includes account identifiers, display names, and optional friend identifiers; sign-in tokens and expiry times; organization identifiers and names, member roles, departments, job titles, organization profile-card names, and joining dates; the organization’s text-based chat messages and last-read message markers; task and announcement content and the associated people, times, and status; and invitations, applications to join an organization, and approval records. The purposes and audiences are explained below. This does not mean that all this information is public to every member.

Messages, task notes, or announcement text you submit may contain personal information about you or others. Check the organization, conversation members, and purpose of the content. Do not submit sensitive information unrelated to collaboration, and obtain the appropriate authorization for information about other people. The current native app contains no advertising or analytics SDKs and does not use advertising identifiers for cross-app advertising tracking.

03Unified account sign-in and sessions

You sign in with a unified Starline account through the system’s web authentication interface. Registration, mobile number or email verification, passwords, passkeys, and any third-party sign-in you choose are handled by the relevant account webpages under Privacy Notice and Starline Account Terms. The absence of these input fields in Xingqi’s native interface does not mean that the account webpages do not process that information. A third-party sign-in service you have not selected does not receive authorization through this process.

After authorization, the app exchanges the authorization result for a sign-in session. It receives the account identifier, display name, optional friend identifier, access token, and expiry time to identify the user, retrieve their organizations, and verify subsequent requests. Friend identifiers are used for account identification. They do not mean that the app reads the system address book or automatically imports personal friends into an organization.

On iOS, the login token, expiry time, and associated account summary are stored in the device Keychain. The App can access them only while this device is unlocked, using a protection setting that does not migrate them to another device. On Android, the session is encrypted with AES-GCM using a key managed by Android Keystore, and the ciphertext is stored in the App’s private directory. The Android App is configured to disable system cloud backup of this App’s data. Some device manufacturers may still perform device-to-device transfer, and copies saved separately by users are not fully controlled by the App. The iOS unlock-access condition does not apply to Android. Tokens are used to access the relevant services and are not shown to colleagues or workplace webpages. You can open the Starline Account Center from Account and Security to manage account information, signed-in devices, and app authorizations. Account-webpage sessions and App sessions should be managed separately.

04Organizations, member information, and management permissions

When you create or join an organization, the service processes the organization identifier, name, creation time, membership, and roles. The organization directory and profile cards also involve account names, profile-card names stored separately for each organization, departments, job titles, and joining dates. Members of the same organization can look up colleague information provided by the service to find people to collaborate with. This organization directory is formed from organization memberships; it does not read or upload the device’s system address book.

You can set your profile-card name for the current organization. That name is stored for that organization and does not change your unified Starline account name. Owners and administrators maintain information such as members, departments, job titles, and organization profile cards according to their roles. Owners may also assign management roles within the permitted scope. When organizing collaboration and maintaining information, an organization should inform members of the purposes and process their personal information lawfully.

Data for different organizations is managed according to organization relationships. Conversations within an organization also check access against conversation membership. A management role does not mean that its holder can view every member’s private chats. Removing a member revokes that member’s access to the relevant organization and conversations; it does not delete historical collaboration records.

05Organization text messages and read positions

When you send a message in an organization’s private chat, group chat, or all-member conversation, the service processes the organization and conversation identifiers, conversation members, sender identifier and name, message text, client message identifier, sending time, and read positions. This is used to deliver and retain messages, prevent duplicate sending, show conversation previews, and calculate unread status. The client message identifier distinguishes sending requests; it is not an advertising identifier.

Messages are stored on the organization collaboration server and made available according to valid organization and conversation memberships. Joining an organization, receiving an invitation, or holding a management role does not grant access to every conversation. Actual visibility depends on the service’s permission checks. Recipients may still copy or save content separately, and the app cannot unilaterally control those copies.

Xingqi currently provides text messages. It does not provide image messages, files, location, audio or video calls, or recording features. The app currently has no message deletion button. Signing out, switching organizations, removing a member, or uninstalling the app does not delete server messages. Requests to delete server data can be submitted through the formal contact channel. See “Retention, deletion, and security” for the relevant limits.

06Task collaboration

When you create, assign, update, or complete a task, the service processes its title, notes, creator, assigned members, deadline, completion status, and creation and update times to organize and track work within the organization. Before assigning a task, check the receiving members and task content. Avoid putting unrelated personal information in notes.

Valid organization members can view the organization task list. Editing, completing, and deleting tasks are subject to roles and operation permissions: creators, assigned members, and managers act within their respective permissions. An ordinary assigned member’s editing permission is limited to completion status. The creator or a manager can delete the relevant task. Deletion does not control copies that other people have already saved separately.

07Announcements and read confirmations

When a manager publishes an announcement, the service stores its title, text, author identifier and name, and publication time. When a member views and confirms that they have read it, the service stores the association between that account and the announcement’s read confirmation, to show the member’s own read status and the read count. Read confirmations are organization collaboration records; they do not disclose everyone’s complete reading activity to all members.

Announcements are provided within the relevant organization, and managers can delete them. Publish content according to actual work needs. Do not use announcements to publicly disclose unrelated personal information. Deleting an announcement is separate from copies that readers save or forward themselves.

08Invitations, applications to join, and approval

When a manager creates an invitation, the service processes its identifier, associated organization, expiry time, and revocation status. An invitation code or link is used to preview and apply to join an organization. Managers can copy or share it using the actions available in the interface. Check who you share it with and protect invitation information. Recipients may forward it again.

Users must first sign in normally, then choose to preview the invitation and confirm an application. Previewing alone creates neither an application nor membership. After submission, the service processes the applicant’s identifier and display name, the relevant organization, linked invitation, submission time, approval status, and decision time. Managers review applications within their permissions. Joining currently requires manager approval; opening an invitation does not automatically add you to the organization.

You can view the progress of your own application. Managers can view and handle pending applications they are authorized to manage. Records of approvals and rejections are retained. An invitation expiring or being revoked, or a member later being removed, does not delete historical applications or decisions. Organization verification services are not currently connected. This notice therefore does not list identity cards, business licenses, or bank information as routine information collected for joining an organization. Before verification is introduced, the information required, recipients, and purposes will be explained separately.

09Local data, clipboard, and system permissions

Enterprise information, loaded messages, and input drafts are currently held temporarily in memory as part of the App’s business state and cleared when you switch enterprises or sign out. This local state differs from records stored on the server. “In memory only” here does not include the separately stored login session described above: iOS uses Keychain, and Android uses session ciphertext in its private directory. Both platforms also store a non-sensitive signed-out marker in a private directory to prevent automatic sign-in restoration if credential cleanup or remote revocation has not yet succeeded.

When you tap “Copy invitation link” or “Copy invitation code”, the app writes the relevant invitation information to the system clipboard. When you tap the system paste button, it reads the text you actively paste. The app does not continuously read the clipboard. System sharing passes content to the receiving app or person you choose. Content already copied, sent, or saved separately is managed by its respective holder.

The native Xingqi App on both platforms currently makes no requests for camera, microphone, location, or system-contacts permissions, and does not embed native components such as LiveKit, ML Kit, or CameraX. The permission currently declared for the Android App’s operation is internet access (INTERNET); this does not grant access to device media, location, or contacts. System webpages, external browsers, share sheets, and websites you choose may request authorization for their own features. Their independent requests do not mean that you authorize the native Xingqi App to read all device information. If future features require additional permissions, we will explain their purpose and request them as needed before use.

10Workplace webpages and external services

Enterprise administrators can configure workplace service names and HTTPS links. When you choose to open a link, iOS loads the page in a separate, non-persistent in-app web session. Android checks that the link uses HTTPS, has a hostname, and contains no URL user-information field (userinfo), then passes it to an external browser or app capable of handling it. Android does not use the iOS-style in-app web container. Neither platform injects Starline login tokens, authorization request headers, account cookies, or scripts into workplace webpages. External websites may still require a separate sign-in and use cookies under their own rules.

When a webpage opens, the destination website receives the IP address, browser-related information, and request content needed for access. Information you choose to enter, upload, or authorize on that page is processed by the website under its own rules. The non-persistent iOS session reduces persistent storage of webpage data in that in-app container; it does not delete information already received by the website, third-party accounts, or content you saved separately. On Android, the external browser or app may use an existing signed-in session and retain its own cookies, cache, or browsing history. It manages that data itself. We cannot promise that signing out of Xingqi, switching enterprises, or uninstalling Xingqi will clear it.

On iOS, the Starline Account Center opens in the system Safari web container, and sign-in authorization uses the system web-authentication entry point. Its web session differs from the in-app container for workplace services. On Android, the Account Center, sign-in webpages, and workplace links open through an external browser or app that the system can use to handle the relevant link. Web sessions and browsing data are managed under that external app’s rules; temporary sessions or isolation between them are not guaranteed. Account-webpage sessions, native Xingqi sessions, and external-app data should be managed separately. Check the URL and the provider’s privacy notice before using a workplace service. Enterprise membership in Xingqi does not automatically grant access to an external website.

11Service providers and third-party processing

On iOS, Apple Inc. and related entities provide capabilities such as system Keychain, web authentication, Safari/WebKit containers, the clipboard, and system sharing. See Apple Privacy Policy for Apple’s own system-service rules. Android uses capabilities supplied by the device system, such as Keystore, opening external links, the clipboard, and system sharing. The actual system, browser, or receiving-app provider depends on your device and selected apps; its independent processing follows the relevant rules. On both platforms, system capabilities process the information needed for system operations and network access according to the features you use. Local storage or use of system capabilities does not mean that all content is sent to the system provider.

See Privacy Notice for the providers, information types, and processing rules for SMS, email, infrastructure, and web sign-in services such as WeChat or Alipay that you choose through the unified Starline account. Connections through websites or servers do not mean that Xingqi’s native app embeds those providers’ payment, advertising, or analytics SDKs, or that it reads the device’s SMS inbox.

Workplace webpages and system share destinations participate in the relevant action according to your or your organization’s choices. The actual providers are identified by the page and share sheet. Independent workplace websites and system share recipients process information under their own rules; Starline cannot guarantee that they process it only for necessary purposes. Providers acting on our behalf participate in processing only as needed for their respective services. If a new provider materially changes recipients, processing purposes, information types, or storage regions, we will notify you as required by law before that processing begins. We require providers acting on our behalf to follow the agreed purposes, scope, and security requirements. This notice does not provide blanket authorization for services that have not yet been determined.

12Audiences, external sharing, and cross-border transfers

Information is provided, as described for each feature above, to members of the same organization, relevant conversation members, task collaborators, announcement recipients, managers, people you choose to share with, and necessary service providers. Their visibility differs. Organization management permissions do not automatically extend to all private chats. We do not sell your personal information for advertising or marketing. An organization that separately copies or exports information must follow the purposes it has disclosed and applicable law.

For transfers, public disclosure, or external sharing beyond the disclosed scope, we will explain the recipients, purposes, methods, and information types as required by law and fulfill the necessary notification, consent, and protection obligations. Legally required cooperation with statutory procedures is an exception, but does not permit arbitrary expansion of processing.

See Privacy Notice for the unified account’s retention rules. Apple or Android system services, external browsers or apps, workplace webpages, and sharing destinations you choose may process information in other countries or regions under their own rules. Xingqi’s local-storage settings do not guarantee the data location of these independent services. If Starline transfers legally protected personal information outside the country, before the transfer it will comply with the applicable notice and separate-consent requirements and complete any required assessment, contract, or certification procedures.

13Retention, deletion, and security

Collaboration records, including organization memberships, messages, tasks, announcements, invitations, applications, and approval records, are retained by the organization service’s server as needed to provide services, maintain necessary work records, and fulfill legal obligations. There is currently no uniform mechanism that clears all collaboration records after a fixed number of days. Applications that have been decided retain their historical results. Invitation expiry does not delete related records. Accounts, authentication challenges, and account security records follow the corresponding rules in Privacy Notice.

Authorized managers can remove members, revoke invitations, and delete tasks, announcements, and workplace service entries. Task creators can also delete their own tasks. The current app has no self-service buttons to leave an organization, dissolve an organization, delete messages, or delete an account. Removing a member revokes access, and deleting a workplace service entry removes a link. Neither automatically deletes other server records or external website data.

A normal sign-out clears the current account and enterprise state held in Xingqi’s memory. iOS attempts to remove session credentials from Keychain. Android attempts to delete the session ciphertext from the private directory and saves a signed-out marker to prevent automatic sign-in restoration while cleanup remains incomplete. The App also attempts to revoke the server session. If cleanup or revocation has not yet been confirmed, the interface reports the relevant status. The Android sign-out process does not delete the App’s session-encryption key in Android Keystore, and it does not clear external-browser data. Signing out, revoking app authorization, switching enterprises, or uninstalling the App is not account deletion, and does not guarantee simultaneous removal of server records, enterprise collaboration history, or other people’s backups.

After receiving a deletion, account deletion, or processing restriction request, we will verify identity, the scope of the information, and the relevant organization collaboration relationships, and explain how the request will be handled. Personal information no longer needed will be deleted or anonymized as required by law. Information that must still be retained by law will have its use restricted. Where other members’ lawful rights, necessary historical organization records, third-party systems, or independently retained copies are involved, we will examine and explain those matters separately. We do not promise immediate erasure of everything or an unverified fixed cleanup period.

We protect information and restrict access to business data through permission checks and safeguards for network transmission. For session protection, iOS uses system Keychain, while Android uses AES-GCM session encryption with keys managed by Android Keystore. These measures apply according to the platform and the actual processing step. They do not mean that the development preview has completed production-service security acceptance checks, and they cannot eliminate all risk. Protect your device, account, and invitation information. If a personal information security incident occurs, we will take remedial action and fulfill notification and reporting duties in accordance with law.

14Your rights and manual request handling

You can view information you are authorized to access within your organization, change your profile-card name for the current organization, and manage editable account information and authorizations in the unified Starline Account Center. To correct departments, job titles, or organization information maintained by managers, contact your organization’s managers. You may also ask Starline to verify information about you.

You may request, in accordance with the law, access to, copies of, correction of, supplementation of, or deletion of personal information; restriction of or objection to certain processing; withdrawal of consent-based authorization; explanations of processing rules; and account deletion. Use the WeCom channel on the Contact Starline page and state the request type, relevant account, organization, and a way to reply. We verify only the identity information necessary to handle the request and do not ask for passwords or verification codes.

For actions with no current self-service button, such as leaving or dissolving an organization, deleting messages, or deleting an account, you can first submit a manual request through the channel above. Organization management relationships and third-party information may need to be handled separately. We will examine permissions, linked services, necessary retention, and effects, and explain the scope of what can be done and the outcome. Withdrawing consent does not affect processing already carried out on the basis of valid consent before withdrawal.

If a request cannot be fulfilled directly, we will explain why and describe any applicable further steps. You may ask for a review through our contact channel or, in accordance with the law, complain or report to authorities responsible for personal information protection, or seek a remedy from a people’s court with jurisdiction. Exercising your personal information rights will not, by itself, result in unreasonable differential treatment.

15Protecting minors

Xingqi is intended for collaboration within organizations and is not designed specifically for children. Minors should use it under a guardian’s guidance and avoid submitting sensitive information unrelated to collaboration. There is currently no separate children’s service or guardian consent process. Users under fourteen should not register or submit personal information on their own.

If a guardian discovers that a child under fourteen has provided personal information without valid authorization, they may request verification, deletion of the information, or account deletion through the Contact Starline page. We will verify and take appropriate action in accordance with the law. Any necessary processing of children’s personal information will follow special protection and guardian consent requirements.

16Changes to this notice

If features, processing purposes, data types, recipients, or other important matters change, we will update this notice, show the date, and provide reasonable notice of material changes affecting personal rights and interests. Organization verification, additional system permissions, and other features not yet enabled will be explained separately before they are provided. Where the law requires renewed or separate consent, we will complete those procedures. Updating a webpage does not replace valid authorization.